AI & Technical question
How would you design a governance model that behaves consistently across Glean's UI, public APIs, and heterogeneous enterprise connectors, for example, a shared policy layer for permissions, action scopes, audit logging, and redaction, even when source systems expose different authentication models and data granularity?
- Glean
- AI & Technical
- Hard
Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.
Start a mock interview on this question · Mock interview from a job description
What this question tests
Tests designing a unified policy layer that behaves consistently across UI, APIs, and heterogeneous connectors, despite source systems having different auth and permission granularity.
How to approach it
- Define a canonical internal permission model, for example a normalized set of scopes and roles, that every connector maps its native auth model into at ingestion time.
- Require every connector to declare its permission granularity, for example document-level versus folder-level, so Glean can flag where enforcement is coarser than the source system.
- Centralize policy evaluation, redaction rules, action scopes, and audit logging, in one shared service that the UI, public APIs, and agent tooling all call, rather than each surface implementing its own checks.
- Handle heterogeneous granularity explicitly: default to the most restrictive applicable policy when a connector cannot express fine-grained permissions.
- Log every policy decision centrally so audit trails are consistent regardless of which surface, UI, API, or connector, triggered the action.
- Pilot the shared policy layer on two structurally different connectors, one with rich native permissions and one without, to stress-test the normalization.
What a strong answer includes
- Proposes a canonical permission model that every connector maps into, instead of letting each connector implement its own enforcement logic.
- Explicitly handles the hard case, a connector with coarse native permissions, by defaulting to the most restrictive policy rather than guessing.
- Centralizes policy evaluation and audit logging in one service so UI, API, and connector behavior can never silently diverge.
- Tests the design against two structurally different connectors up front, rather than assuming one connector's model generalizes.
Common mistakes
- Letting each connector or surface implement its own permission logic, which drifts out of sync over time.
- Assuming all source systems expose similarly granular permissions when many do not.
- Building audit logging per surface instead of centrally, breaking a unified audit trail.
Likely follow-up questions
- How would you handle a connector that changes its native permission model after launch?
- What would you do if the most-restrictive default makes the product unusably restrictive for some customers?
More ai & technical questions
- How would you measure whether Glean's AI answers are accurate and well-cited?Glean · AI & Technical · Medium
- A Fortune 500 customer asks for an audit trail for every AI-agent answer: which data sources were accessed, which permissions were applied, why the response was generated, and whether sensitive content was filtered or redacted. Design the admin and end-user experience, and the core APIs/data model needed to support this without overwhelming either audience.Glean · AI & Technical · Hard
- Several enterprise customers report that the ServiceNow and GitHub connectors are ingesting data successfully, but search results and assistant answers still feel incomplete or low quality. How would you diagnose where the breakdown is across crawl freshness, permissions sync, metadata extraction, entity mapping, ranking, and UX, and how would you decide which fixes to ship first?Glean · AI & Technical · Hard
- Design the next version of Glean’s Indexing API and custom connector platform for large enterprises that need to bring proprietary data sources online quickly. What core capabilities would you prioritize, such as schema/modeling, auth and permissions, incremental sync, observability, and governance, and what principles would you use to keep the platform flexible without creating an inconsistent product experience?Glean · AI & Technical · Hard
- Glean Model Hub lets enterprise customers choose among LLMs for search, assistant, and agent workflows. How would you build a model-provider evaluation framework to decide which new providers to add, including the gating criteria, offline/online evals, and the tradeoffs you would make across answer quality, latency, security, cost, and enterprise-specific requirements?Glean · AI & Technical · Hard
- Suppose Glean wants to launch a new answer-generation experience in core search. How would you define the MVP and rollout plan given enterprise constraints around permissions, citations, latency, model choice, and admin controls? What would need to be true before you scaled it broadly?Glean · AI & Technical · Hard
More questions from Glean
Learn the skill behind it
Chapters of the AI PM course that teach what this question tests.
- Chapter 1: Foundations: the model and the decisions it forces on you
- Chapter 8: Evals: define good and make the number defensible
- Chapter 6: Agents and agentic architecture